Each Received line names a server, the address it received from, and a timestamp. Comparing consecutive timestamps shows where a delay occurred, which answers most questions about slow delivery in a few seconds.
Authentication-Results is the dense one. Look for spf=pass, dkim=pass and dmarc=pass, and check the domain attached to each. An SPF pass for your platform's bounce domain rather than your own is a pass that does not align.
Return-Path holds the envelope sender, which is what SPF was evaluated against and where bounces go. It routinely differs from the From header, and a large difference is worth understanding rather than assuming.
Message-ID identifies the message uniquely and is what a mail administrator will ask for when tracing something through server logs. Copy it exactly, including the angle brackets.
Spam scoring headers such as X-Spam-Status are added by the receiving system and vary by software. Where present they often name the individual rules that fired, which points straight at what a filter objected to.
A delayed message, traced hop by hop
Say a customer tells you that your quote arrived half an hour late. Open the header and read the Received lines from the bottom. The lowest one shows your server taking the message at 09:14:02. One line up, your sending platform passes it on at 09:14:05. At the top, the customer's mail gateway records it at 09:41:37.
Three seconds between the first two hops is normal. The 27-minute gap sits between your platform and their gateway. So the delay was on the receiving side, most likely greylisting or a busy security scanner, and nothing on your end needs fixing.
Watch the time zones before you subtract. Each stamp ends with an offset such as +0000 or -0700, and two servers in different zones can look hours apart when they're seconds apart. Convert them all to one zone first. A wrong clock on one server can also fake a gap, so be suspicious of any hop that shows negative time.
One line that tells you whether alignment passed
Say the Authentication-Results line reads spf=pass smtp.mailfrom=bounce.mailer.example; dkim=pass header.d=yourbrand.com; dmarc=pass header.from=yourbrand.com. There are three passes there, and they aren't equal.
The SPF pass is for the mailing platform's bounce domain, which doesn't match your From address. It passed, but it doesn't line up. The DKIM pass names yourbrand.com, which does match. DMARC needs only one of the two to line up, so it passed on the strength of DKIM alone.
That tells you something practical. If this message gets forwarded by a mailing list and a footer breaks the signature on the way, nothing is left to carry DMARC. Setting a custom bounce domain on your platform gives you a second aligned path.
On forwarded mail you may also see headers that start with ARC. Those are the forwarding service's record of what passed before it touched the message. Big providers use them to forgive a break that the forward caused.
Related questions
Which direction do I read Received lines?
Bottom to top. Each server prepends its line, so the oldest hop is at the bottom and final delivery at the top.
Where do I find the full header?
Gmail uses Show original, Outlook uses View message source, Apple Mail uses View then Message then Raw source.
What does dmarc=pass actually confirm?
That SPF or DKIM passed and aligned with the visible From domain. Either path alone is sufficient.
Can headers be forged?
Ones added by the sender can be. The Received lines added by trusted servers near delivery are the reliable part.